Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:LSummary
CVE-2026-33510 is a high-severity Improper Neutralization of Alternate XSS Syntax (CWE-87) vulnerability in Homarr Homarr. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Content Injection (T1659); ranked at the 14th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-33510 is a DOM-based Cross-Site Scripting (XSS) vulnerability affecting Homarr, an open-source dashboard, in versions prior to 1.57.0. The issue resides in the /auth/login page, where the application improperly trusts the callbackUrl URL parameter and passes it directly to redirect and router.push functions without proper sanitization. This flaw is associated with CWE-87 (Improper Neutralization of Special Elements used in an XSS Attack) and CWE-601 (URL Redirection to Untrusted Site ('Open Redirect')).
An unauthenticated attacker (PR:N) can exploit this vulnerability over the network (AV:N) with low complexity (AC:L) by crafting a malicious link containing a payload in the callbackUrl parameter. The attack requires user interaction (UI:R), such as an authenticated victim clicking or opening the link, which triggers a client-side redirect and executes arbitrary JavaScript in the victim's browser context with changed scope (S:C). Successful exploitation can result in high confidentiality impact (C:H), such as credential theft, along with low integrity (I:L) and availability (A:L) impacts, including internal network pivoting and unauthorized actions on the victim's behalf. The CVSS v3.1 base score is 8.8.
The vulnerability has been fixed in Homarr version 1.57.0. Security practitioners should upgrade to this version or later. Additional details are available in the GitHub security advisory at https://github.com/homarr-labs/homarr/security/advisories/GHSA-79pg-554g-rw82.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-19287
Vulnerability Data
Homarr is an open-source dashboard. Prior to 1.57.0, a DOM-based Cross-Site Scripting (XSS) vulnerability has been discovered in Homarr's /auth/login page. The application improperly trusts a URL parameter (callbackUrl), which is passed to redirect and router.push. An attacker can craft…
more
a malicious link that, when opened by an authenticated user, performs a client-side redirect and executes arbitrary JavaScript in the context of their browser. This could lead to credential theft, internal network pivoting, and unauthorized actions performed on behalf of the victim. This vulnerability is fixed in 1.57.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.7.2
Mitigating Controls (NIST 800-53 r5) AI
SA-11 requires developer testing and analysis that can discover improper neutralization of alternate script syntax after it has been coded.
SI-10 directly requires validation/sanitization of untrusted inputs, which structurally stops alternate XSS syntax from reaching the interpreter.
Information flow enforcement can restrict redirects to only approved/trusted destinations, stopping untrusted user-supplied URLs from being followed.
SA-8 mandates secure engineering principles such as input neutralization and output encoding that prevent introduction of this class of flaw.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require proper input neutralization and output encoding to prevent alternate XSS syntax.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure coding standards require proper neutralization of alternate script syntax, directly eliminating CWE-87.
Security testing catches residual XSS but does not itself implement the neutralization controls.
Preventing access to attacker-controlled or malicious sites stops users from being redirected to untrusted locations via open-redirect or phishing links.
Secure SDLC mandates input validation and output encoding that directly prevent alternate XSS syntax.
Application security requirements explicitly call for neutralization of untrusted input to block XSS variants.
Secure architecture principles reduce attack surface but do not prescribe specific encoding rules.